johan
/
clavitor
1
0
Fork 0
Code Issues 7 Pull Requests Packages Projects Releases Wiki Activity
clavitor/clavis/clavis-vault/lib
History
James a2cfff8ec2 Complete replication implementation with L0/L1 auth (Commercial Only) 
Replication now fully functional for Commercial Edition:

Authentication:
- Uses existing vault L0/L1 credentials (same as vault access)
- L0 in X-Clavitor-L0 header (vault ID)
- L1 in X-Clavitor-L1 header (vault encryption key)
- Validated by opening vault DB with L1
- Anti-replay: 5-minute timestamp window

Architecture:
- Primary-only POPs: No config file needed
- Replication POPs (Calgary/Zurich): Config in /etc/clavitor/replication.yaml
- Config has replication.peers list (can be empty for primary-only)
- Event-driven: SignalReplication() on every write

Files added:
- api/replication.go: HTTP handler for incoming replication
- api/routes_commercial.go: Commercial-only route registration
- api/routes_community.go: Community stub
- lib/auth.go: ValidateL0L1() for vault credential validation
- lib/base64.go: Base64URLEncode/Base64URLDecode helpers

Files modified:
- edition/config.go: New config structure with peers list
- edition/edition.go: ReplicationConfig struct with peers
- edition/replication.go: Replicate to all peers, use new config
- edition/backup_mode.go: Removed env var, config-based
- cmd/clavitor/main.go: Load config, nil config = primary-only
- api/routes.go: Call registerCommercialRoutes()

Security:
- L0/L1 auth prevents unauthorized replication
- Timestamp window prevents replay attacks
- Audit alerts on auth failures and rejections
 		2026-04-02 01:21:20 -04:00
..
auth.go Complete replication implementation with L0/L1 auth (Commercial Only) 2026-04-02 01:21:20 -04:00
backup.go Security hardening v2: Edition system + 24 security fixes 2026-04-02 00:36:31 -04:00
base64.go Complete replication implementation with L0/L1 auth (Commercial Only) 2026-04-02 01:21:20 -04:00
config.go chore: auto-commit uncommitted changes 2026-03-28 06:01:23 -04:00
crypto.go chore: auto-commit uncommitted changes 2026-03-25 06:04:04 -04:00
crypto_test.go chore: auto-commit uncommitted changes 2026-03-26 06:03:15 -04:00
cvt.go feat: vault v2 rewrite — CVT tokens, scoped access, agents-as-entries, 14 importers 2026-03-31 13:36:04 -04:00
cvt_test.go feat: vault v2 rewrite — CVT tokens, scoped access, agents-as-entries, 14 importers 2026-03-31 13:36:04 -04:00
dbcore.go Replication v2: Active-Passive with Async Sync (Commercial Only) 2026-04-02 00:50:20 -04:00
id.go chore: auto-commit uncommitted changes 2026-03-25 06:04:04 -04:00
id_test.go chore: auto-commit uncommitted changes 2026-03-26 06:03:15 -04:00
importers.go chore: auto-commit uncommitted changes 2026-03-25 06:04:04 -04:00
importers_test.go chore: auto-commit uncommitted changes 2026-03-26 06:03:15 -04:00
l2labels.go chore: auto-commit uncommitted changes 2026-03-25 06:04:04 -04:00
telemetry.go Security hardening v2: Edition system + 24 security fixes 2026-04-02 00:36:31 -04:00
tls.go chore: auto-commit uncommitted changes 2026-03-29 06:01:26 -04:00
types.go Security hardening v2: Edition system + 24 security fixes 2026-04-02 00:36:31 -04:00